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Singapore: Autonomous bus services scheduled by 2022 
Shanghai: Autonomous bus testing 

Guangzhou: Public road testing since 2018 

Beijing: Baidu testing on 105km of suburban roads 


Baidu-Volvo partnership: Level 4 autonomy taxis by 2021 


The Revolution Is Coming 


Civil Applications 


Transportation Oceanography Mapping 


Civil Applications 


* Unmanned cargo shipping 


e 7576 of maritime accidents caused by human 
error 


* Major technical challenge: dealing with hardware 
failure on long voyages 


Civil Applications 


Zero Emission «| Yara Birkeland 
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9 Kongsberg Yara Birkeland 
* Zero emissions, autonomous capable 
* Replaces 40,000 annual truck trips 
* 2020: Manned operation & testing 
е 2021: Downcrewing 


е 2022: Fully autonomous operation 


Civil Applications 


9 Priorities: 
* Precision Agriculture 
e Self-Driving Cars 

9 Roadblocks: 


Classic Failures 


Classic Failures 


Crash 
attenuator 


Fatal Tesla Autopilot Accident 
US-101, March 2018 


Dynamic cruise control + autosteer lane following 


120 kph impact with previously damaged crash attenuator 


Vehicle selected poor lane markings over lead vehicle 


Fragile decision making & edge cases abound 


Autonomous Vehicle Logic 
Structures 


Activity Hierarchy 


Mission Task Planners/Reasoners 


Navigation & Localization 


Autonomous Vehicle Logic 
Structures 
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Lifesaving Drone Pizza Delivery 


Dynamic “bombing run” 


ES — planner, impact point Dispense pizza to credit card — шанг 
Planners/Reasoners De nee роп nn: Planners/Reasoners 
estimator 
Navigation & Localization — СРЅ waypoint circuit Route planning from SLAM- HEN 


generated sensor map 


Dynamic obstacle 
discrimination & avoidance 


None! 


Sensors 


* Active vs Passive 


* Common sensors: 
* GPS 
* LIDAR 
* Cameras 
* Millimeter Wave Radar 


* Ultrasonic Transducers 


Digital Compass 


Sensors 


9 Sources of uncertainty: 
* Noise 
9 Drift 


9 Latency & update rate 


* Uncertainty must be modeled under assumptions 

Sensor fusion:‏ و 
Fused/registered data can be more useful than separate‏ * 
What to do when sensors disagree?‏ * 

* Robot robustness may come down to: 


* How smart is it at discounting | bad/spoofed sensor? 


Sensor Attacks 


9 2 kinds: 


* Denial 


GPS 


e Denial: 


* Jamming 


e Spoofing: 


* Fake GPS satellite signals at higher 
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—RQ170‏ هَوَابِسّماى ببشر فته جاسوسى آمريكا 
Juil‏ شبكه یک 
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® HackRF One 
9 10 MHz TCXO low drift (+2.5ppm) oscillator 


* Daughterboard for oscillator 
* GPS ephemeris data (NASA) 


® gps-sdr-sim 


Demo Time 


ET чі ans 


2D sensor highly orientation dependent 
* Inclines can look like obstacles 


* May miss low obstacles & discontinuities 


LIDAR 


LIDAR 


Russian “Васа!” GPS jammer 


- 10 الاختفاء في الأماكن كثيفة الأشجار لشها فضل وسيلة 
- 11 اللجوء إلى الأماكن غير المضاءة بأشعة الشمس JES‏ المبانیه وا لاشجار 


LIDAR 
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Direction of the 1 i 
light source | -Direction of the 
light source 


Shin, Kim, Kwon, Kim, KAIST, 2017 


Attacker vehicle 


* Spoofing: weaker sources cause false returns 
* Can exploit curved glass refraction to alter location of false returns 


* Depends on source strength 


Room 
Perimeter 4% 
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Transmitter | 


Induced Fake Dots 


Lidar rec ene pl | Spoofer Location 
Shin, Kim, Kwon, Kim KAIST, 2017 IF; 


9 Spoofing: Relay attack 18 Location 


® Timing is critical for placement of fake returns 


Tesla Autopilot 


Rearward Looking Side Cameras Wide Forward Camera Main Forward Camera 


Max distance 100m Max distance 60m Мах dista 


Rear View Camera Ultrasonics Forward Looking Sick 
Max distance 50m Max distance 8m Max distance 80m 


Cameras 


Narrow Forward Camera 


Cameras 


Cameras 


(a) Image 


(b) Prediction 


Eykholt et al, 2018 


shield, buck 


Athalye et al, 2018 
* Spoofing deep learning recogni 


* Crafted adversarial examples 
* So far generally white box techniques 


* Do not currently work reliably in face of parametric distortions 


Cameras 


Tencent Keen Lab, 2019 
* Fragile discriminators 


* Lane markings successfully blurred in real world 


* Small fake markers cause lane adjustment 
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Oscilloscope 
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Signal Generator. 


(a) Drive gear. (b) Autopilot. (c) Jammed. 


* Jamming: Contactless Sensor Attacks 
* Liu, Yan, Xu, DEF CON 24 
* Spoofing & relay attacks theorized but not performed 


Frequency Multiplier 


ІМО & Compass 


* Primary navigation sensor for some systems 
9 High fidelity models available 

* Typical cumulative error: 0.1% of distance traveled 
* Denial/spoofing: 

* Extremely difficult to interfere with 

* Physical attacks with magnetic fields, thermal drift 


pais tument | | 


* MEMS gyroscope vibrates & has resonant frequency 


Son et al, KAIST, 2015. 


* Can be perturbed with external acoustic source 
* Similar to well-known attacks on spinning hard disks 


* Successfully POC'd by crashing flying multirotor UAV 


MLS Odometry 


PS E 


* Encoders 
* Useful to know true speed & when stopped 
* Attacks: 
* Change wheel diameter 
* Slippery surface 
* Removal may cause unpredictable behavior or stoppage 


Ultrasonic 


Sensors 


Original 
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‘Contactless Sensor Attacks (Lu, Yan, Xu, DEF CON 
24) 


* Automated parking sensor 
* Only used at low speed 
* Attacks: 

* Jamming 

* Spoofing 


* Cancellation 


Bond vs Robots 


* GPS Jammer 

* Smoke/Dust/Vapor 

* Lightweight decoy obstacles 
е Chaff 


* Glass caltrops 


* Oil slick 


Bond vs Robots 


* Active LIDAR Jammer/Spoofer 
* Active Radar Jammer 
* Acoustic Blaster 


* Lane Marker & Adversarial Turtle 
Dispenser 


e Traffic lights 


* Camera knows where to look 


* Difference in robot vs human 
assumptions 


Exploiting the Logic 


Trapping/Redirecting 
"im i: sc 


Clobbering 


Goal: make robot run into something 

Subvert collision avoidance 

* Incapacitate vehicle 

* Damage/remove sensors 

Subtle map deviations 

Imitate light vegetation 

Simulate obstacles at speed 

Disguise entrance walls with reflective/absorbent material within GPS noise 


Dynamic obstacles under overhead signs 


Would you buy a self-driving car that couldn't 
drive itself in 99 percent of the country? 
Or that knew nearly nothing about parking, 
couldn't be taken out in snow or heavy rain, 
and would drive straight over a gaping pothole? 


If your answer is yes, 


then check out the 


V2N 


Vehicle-to-Vehicle Communications: 
Readiness of V2V Technology for 
Application 


V2V Components 


| Scenario example | 


Forward collision warning 
Approaching a vehicle that is. 
decelerating or stopped. 

Rear end 

collision 
Emergency electronic 
brako light warning 


Approaching a vehicle. 
‘stopped in roadway but not 
isible due to obstructions. 


Blind spot warning 
Beginning lane departure that 
could encroach on the travel 
Jane of another vehicle traveling 
іп the same direction; can detect 
vehicles not yat in blind spot 
Lane change. 
scenarios 
Do not pass warning 
Encrosching onto the travel 
lane cf another vehicle 
traveling in opposite direction: 
сап detect moving vehicles not 
yet in blind spot 


Blind intersection warning 


Encroaching onto the travel lane. 

Intersection ої another vehicle with whom 

scenario driver is crossing paths at a blind 
intersection or an intersection 
without a traffic signal 


* Just warnings for now! 


V2V Components 


‘Security system 
Provides and venies V2V security certificates to ensure trust between vehicles 


GPS, DSRC 
‘antennae 


in-vehicle components 


Dedicated Short Range 
Communications û o 1 
(DSRC) radio 5 [eal 

Receives and transmits 

+ Provides timekeeping Generates wari 
data trough antennae signal or applications ` JÎÎ | issued to arver 


application. 

Stores securty certificates. tronic control unit 
application data, and ` Ў Runs safety applications Existing network that 

other information | interconnects components 


* Both on-board and roadside communicators 
® DSRC: Omnidirectional, 300m range, 200-500 bytes 
* Basic Safety Message (BSM) protocol 


* Not encrypted 
* PKI authenticated (signed via certificates) 


V2V Transmissions 


Table V-1 Contents of BSM Part I^ 


Data Data Element (DE) 
Position (DF) 


Motion (DF) 


* Part I: Core 
* Part Il: Appended when changed, vehicle-specific 
* Note unencrypted GPS 
* Spoofing feedback? 
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Device Confit, 


V2V Security 


Misbahavlor Authority 


Internal | Global || сї 
Зыбін] Detection | Generator 
Manager | 
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Legend 


Intinsically || Central by 
Central Choice. 


— Regular Communication 


PM Bottom Lines 


® V2V/V2l aims to avoid mistakes of current traffic sensors 
® Hacking US Traffic Control Systems, Cesar Cerrudo (W/O Active, DEF CON 22 


* No encryption/authentication, wireless transmission in cleartext 


* Firmware updates neither encrypted nor signed 


* No doubt will make others! 


Consequences 
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10 Hacked 
Vehicles/km/lane 


0% Hacked at rush 
hour 


10% Hacked at 
rush hour 


20% Hacked at 
rush hour 


Remember... 


| 


